Always listen on all hosts. Only use the host part of a frontend address for TLS cert names. Customizing the listen host will be better done with a `bind` directive, like Caddy does.